Ok, I have set up both config.ini and inputs.conf with my server info. Running | jira filters in Splunk though returns nothing. Querying the API from my indexers and my search-heads returns results successfully: curl -u <jira_username> "https://jira.gamesys.co.uk/rest/api/2/filter/favourite?expand" Enter host password for user '<jira_username>': [{"self":"https://jira.gamesys.co.uk/rest/api/2/filter/16852","id":"16852","name":................ My conf files look like this: config.ini [jira] hostname = jira.gamesys.co.uk username = <jira_username> password = <jira_password> jira_protocol = https jira_port = 443 inputs.conf [jira] sourcetype = jira index=jira interval = 60 server = jira.gamesys.co.uk protocol = https port = 443 jql = issueType in (epic, story) username = <jira_username> password = <jira_password> Any idea what the issue could be? ... View more

Managed to implement this by first configuring it on the deployer, than moving it to the cluster folder for distribution to SHC members. Thanks for the tip! ... View more

Hi, First of all, thank you for your prompt reply. Unfortunately both indexes suggested above did not return any data. We're used sourcetype=audittrail to get the list of XMLs deleted however the user value shown is "n/a" which is most probably referring to a job which was automatically run by the system. ... View more